与JSF集成Spring Security导致重定向循环

我有使用JSF创建的自定义登录页面。但是一旦我运行该应用程序，我会收到错误消息“Firefox已经检测到服务器正在以永不完整的方式重定向该地址的请求。”与JSF集成Spring Security导致重定向循环

这里是我的web.xml：

<context-param> 
    <param-name>contextConfigLocation</param-name> 
    <param-value> 
      /WEB-INF/applicationContext.xml 
      /WEB-INF/applicationContext-security.xml 
    </param-value> 
</context-param> 


<!-- Enable Spring Security --> 
<filter> 
<filter-name>springSecurityFilterChain</filter-name> 
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
</filter> 

<!-- Allow login pages with JSF which redirects to security check, 
therefore we have to add the forward entry here --> 
<filter-mapping> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <url-pattern>/*</url-pattern> 
    <dispatcher>FORWARD</dispatcher> 
    <dispatcher>REQUEST</dispatcher> 
</filter-mapping>

而且我applicationContext-security.xml

<http auto-config='true' use-expressions="true" access-denied-page="/index.xhtml"> 
    <intercept-url pattern="/jsf/admin_*" access="hasRole('ADMIN')"/> 
    <intercept-url pattern="/jsf/pm_*" access="hasRole('PM')"/> 
    <intercept-url pattern="/jsf/la_*" access="hasRole('ACCOUNT_APPROVER')"/> 
    <intercept-url pattern="/jsf/bc_*" access="hasRole('BILLING_CONTACT')"/> 
    <intercept-url pattern="/**" access="hasRole('USER') or hasRole('ADMIN') or hasRole('PM')"/> 
    <form-login login-processing-url="/j_spring_security_check" login-page="/login.xhtml" /> 
</http> 

<authentication-manager> 
    <authentication-provider user-service-ref='myUserDetailsService'> 
     <password-encoder hash="sha"/> 
    </authentication-provider> 
</authentication-manager>  

<beans:bean id="myUserDetailsService" class="lk.mazarin.wcplus.security.WcUserDetailsServiceWrapper"> 
    <beans:property name="wcUserDAO" ref="wcUserDAO"/>  
</beans:bean> 

<beans:bean id="wcPasswordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"/>

来源

2013-04-18 user1266343

正如@Michael指出的，您需要从登录页面中删除安全限制。该filters属性已被废弃，并有另一种方式做到这一点在最新的版本中使用Spring Security：

<http ...> 
    .... 
    <!-- This line goes BEFORE /** pattern --> 
    <intercept-url pattern="/login.xhtml*" access="permitAll" /> 
    .... 
    <intercept-url pattern="/**" access="hasRole('USER') or hasRole('ADMIN') or hasRole('PM')"/> 
    ... 
</http>

来源

2013-04-18 08:22:51

谢谢，@Maksym Demidas :) – Michael 2013-04-18 08:25:04

你是惠康 – 2013-04-18 08:28:21

上登录URL请不要添加授权。请将以下内容添加到您的applicationContext-security.xml中：<intercept-url pattern="/login*" filters="none" />

来源

2013-04-18 07:02:34 Michael

+1从登录页面删除安全限制 – 2013-04-18 08:23:18

与JSF集成Spring Security导致重定向循环

回答

相关问题